The 'gekko-trading-bot' npm package version 4.2.0 includes a postinstall hook that runs setup.js, which unconditionally downloads a binary named core.exe from a Cloudflare Workers subdomain (c2-proxy.metamasksvc.workers.dev). This domain is spoofed to resemble MetaMask but is not affiliated with it. The downloaded executable is saved as ~/.gekko/gekko.exe on Windows systems. There is no version pinning or integrity verification of the binary. The package metadata impersonates the legitimate Gekko crypto trading bot but directs users to an unrelated GitHub repository (github.com/0xWelsh/gekko). Installing this package results in staging an opaque attacker-controlled binary in the user's home directory at install time.

Installing this malicious package on Windows results in an attacker-controlled executable being silently downloaded and placed on the user's system. This executable could be used to execute arbitrary malicious actions, compromising system integrity and user security. The impersonation of a legitimate open-source project increases the risk of unsuspecting users installing the trojanized package.

No official patch or remediation is currently documented. Users should avoid installing 'gekko-trading-bot' version 4.2.0 from untrusted sources. Verify package authenticity by checking the official Gekko project repository and avoid packages that point to unrelated repositories or domains. Monitor for updates from the legitimate project or npm advisories for remediation guidance. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.